[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Interfaces for Personal Identity Verification_ Part 1 – PIV Card Application Namespace, Data Model and Representation provide?

[Assistant]
<!-- image -->

## NIST Special Publication 800 NIST SP 800-73pt1-5

## Interfaces for Personal Identity Verification

Part 1 PIV Card Application Namespace, Data Model, and Representation

Hildegard Ferraiolo Ketan Mehta Salvatore Francomacaro Ramaswamy Chandramouli Sarbari Gupta

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-73pt1-5

<!-- image -->

## NIST Special Publication 800 NIST SP 800-73pt1-5

## Interfaces for Personal Identity Verification

Part 1 -PIV Card Application Namespace, Data Model, and Representation

Hildegard Ferraiolo Ketan Mehta Salvatore Francomacaro Ramaswamy Chandramouli Computer Security Division Information Technology Laboratory

Sarbari Gupta

Electrosoft Services, Inc. This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-73pt1-5

July 2024

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

National Institute of Standards and Technology Laurie E. Locascio, NIST Director and Under Secretary of Commerce for Standards and Technology

Certain equipment, instruments, software, or materials, commercial or non-commercial, are identified in this paper in order to specify the experimental procedure adequately. Such identification does not imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative.

Interfaces for Personal Identity Verification_ Part 1 – PIV Card Application Namespace, Data Model and Representation


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities:

## Secure Software Development Framework (SSDF) Version 1.1:

## Secure Software Development Framework (SSDF) Version 1.1:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications.  Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST.

Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Cybersecurity Framework Version 1.1 Manufacturing Profile provide? (Part 5)

[Assistant]
ce of the manufacturing system's security

The Profile is built around the primary functional areas of the Cybersecurity Framework which enumerate the most basic functions of cybersecurity activities.
The five primary functional areas are: Identify, Protect, Detect, Respond, and Recover. These primary functional areas comprise a starting point from which to develop a manufacturer-specific or sector-specific Profile at the defined risk levels of Low, Moderate and High. This Manufacturing 'Target' Profile focuses on desired cybersecurity outcomes and can be used as a roadmap to identify opportunities for improving the current cybersecurity posture of the manufacturing system. The Manufacturing Profile provides a prioritization of security activities to meet specific business/mission goals. Relevant and actionable security practices that can be implemented to support key business/mission goals are then identified. This Manufacturing Profile provides a voluntary, risk-based approach for managing cybersecurity activities and reducing cyber risk to manufacturing systems. The Manufacturing Profile is meant to enhance but not replace current cybersecurity standards and industry guidelines that the manufacturer is embracing. ## Table of Contents

| Executive Summary......................................................................................................v   | Executive Summary......................................................................................................v                                                                         |
|----------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.

Cybersecurity Framework Version 1.1 Manufacturing Profile

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.5 (NIST 3.3.5)?

[Assistant]
According to Guide to SSL VPNs:

3.3.5                                                                                | Encryption and Integrity Protection... 3.3.5 Encryption and Integrity Protection

SSL VPNs use the underlying SSL protocol to protect the confidentiality of data using encryption and to provide data integrity (ensuring that the data has not been modified).


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Application Container Security Guide:

アプリの脆弱性 | ..........................................................................................................................................18 | | 3.4.5 未承認コンテナ ..........................................................................................................................................18 | | | 3.5 ホスト OS のリスク ..........................................................................................................................................18 | | | 3.5.1 大きなアタックサーフェス | ........................................................................................................................18 |


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Personnel Security?

[Assistant]
According to Security Segmentation in a Small Manufacturing Environment:

on the network. | Security segmentation identifies assets and groups them into security zones, which can help with inventory management. Asset inventory is an intrinsic part of security segmentation.
|
| Poor visibility of assets and network traffic: without real-time visibility of assets and network traffic, it is difficult to detect new devices, nefarious activities, or a device going offline. | Security segmentation facilitates implementing network visibility tools through creation of security zones. Security zones break down assets into small groups, so it is easier to set up monitoring tools and analyze results. |
| Lack of isolation: absence of isolation between different parts of the network enables an attacker to easily move from one system to another. | Grouping assets into security zones can make it easy to identify where to use isolation. |
| Undefined separation of duties: without the capability to implement separation of duties, a single person may have the ability to change the way systems operate without any oversight or approval. This could allow an attacker who compromises that user's account to make changes without anyone else noticing. | Security segmentation can help clarify who should be able to make changes to systems and who should approve those changes, which can simplify implementation of role-based or rule-based authentication. |
| Absence of least privilege: in a system that does not limit privileges, individuals may have the ability to perform actions they are not authorized to perform. Additionally, this means anyone with an account on a system can do whatever they want. This means an actor with access to one account can do more damage than if the account had limited privileges. | The application of security segmentation can make implementation of least privilege easier as each security zone has a well-defined function.

Security Segmentation in a Small Manufacturing Environment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Computer Security Training & Awareness Course Compendium:

| COURSE NAME | PAGE | |---------------------------------------------------------------------------|--------| | A FRAUD UPDATE: FORENSIC AND INVESTIGATIVE AUDITING | 24 | | A PRACTICAL APPROACH TO CERTIFYING A SYSTEM | 83 | | ADP SECURITY OFFICERS (ADPSO) CONCEPTS | 2 | | ADVANCED DATA COMM NETWORKS: SECURITY/AUDITABILITY | 55 | | ADVANCED EDP AUDITING - GBA 577 | 79 | | ADVANCED TECHNOLOGY CONFERENCE | 10 | | ADVANCED NETWORK SECURITY ARCHITECTURE | 75 | | AIS SECURITY STRATEGIES | 60 | | APPLICATION SECURITY REVIEWS | 30 | | ARCHITECTURE FOR SECURE SYSTEMS | 73 | | AUDIT SOFTWARE FOR THE 21ST CENTURY | 48 | | AUDIT AND SECURITY OF CLIENT/SERVER ARCHITECTURES | 24 | | AUDIT AND SECURITY OF RELATIONAL DATABASES AND APPLICATIONS | 57 | | AUDIT AND CONTROL OF END-USER COMPUTING (EUC) | 40 | | AUDIT AND CONTROL OF ELECTRONIC DATA INTERCHANGE | 39 | | AUDIT, CONTROL, AND SECURITY OF LAN AND MAINFRAME CONNECTIVITY | 31 | | AUDITING EDI APPLICATIONS | 47 | | AUDITING THE DATA CENTER FOR CONTROLS, EFFICIENCY, AND COST-EFFECTIVENESS | 68 | | AUDITING THE DATA CENTER (M2020) | 36 | | AUDITING FRAUD: PREVENT, DETECT, & CONTROL | 54 |

Computer Security Training & Awareness Course Compendium


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.1 (NIST 3.3.1)?

[Assistant]
According to Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services:

3.3.1 GPS SPS IANA TZDB ICAO 9849 1, 6. 3.3.1 IETFCMP 6 NIST SP 800-37 3 NIST SP 800-53 Rev.

Foundational PNT Profile_ Applying the Cybersecurity Framework for the Responsible Use of Positioning, Navigation, and Timing (PNT) Services


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.2 (NIST 3.3.2)?

[Assistant]
According to Satellite Ground Segment_ Applying the Cybersecurity Framework to Satellite Command and Control:

3.3.2, 3. 3.3.2, 3. 3.3.2, 3.

Satellite Ground Segment_ Applying the Cybersecurity Framework to Satellite Command and Control


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Computer Security Division 2006 Annual Report:

- Provide assistance in using NIST guides to comply with FISMA -  Information Technology  Laboratory  (ITL)  Computer  Security  Bulletin Understanding  the  New  NIST  Standards  and  Guidelines  Required by  FISMA:  How  Three  Mandated  Documents  are  Changing  the Dynamic of Information Security for the Federal Government (issued November 2004). - Provide  a  specification  for  minimum  security  requirements  for Federal information and information systems using a standardized, risk-based  approach -  Developed  FIPS  200, Minimum  Security Requirements  for  Federal  Information  and  Information  Systems (issued March 2006). - Define minimum information security requirements (management, operational, and technical security controls) for information and information systems in each such category - Developed SP 800-53, Recommended  Security  Controls  for  Federal  Information  Systems (revision 1 issued December 2006). - Identify methods for assessing effectiveness of security requirements - SP 800-53A, Guide for Assessing the Security Controls in Federal Information Systems (second public draft issued April 2006). - B ring the security planning process up to date with key standards and guidelines developed by NIST - SP 800-18 Revision 1, Guide for Developing Security  Plans  for  Federal  Information  Systems (issued February 2006). - Provide  assistance  to  Agencies  and  private  sector -  Conduct ongoing,  substantial  reimbursable  and  non-reimbursable  assistance support, including many outreach efforts such as the Federal Information Systems Security Educators' Association (FISSEA), the Federal Computer Security  Program Managers' Forum (FCSM Forum), the Small Business Corner, and the Program Review for Information Security Management Assistance (PRISMA).

Computer Security Division 2006 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Awareness and Training?

[Assistant]
According to Workshop Summary Report for “Workshop on Foundational Cybersecurity Activities for IoT Device Manufacturers”:

- Create clear standards and guidelines from a cybersecurity and privacy perspective for IoT device manufacturers and solution providers.
- Certification and labeling programs are emerging for both devices and overall solutions.
- Data standards, integration, and communication protocols can help facilitate ecosystem compatibility to ensure devices can communicate.
- Dependable supply chains are important.
- Clear and consistent standards increase device interoperability and decrease cost.
- Providing direction on 'mandatory' requirements would benefit manufacturers.
- Educating the workforce and/or future workforce for the digital transformation of the economy, such as developing training initiatives to increase skilled resources to implement and maintain IoT solutions.
- Public and private partnerships strengthen IoT security by leveraging the strengths, knowledge, and resources from both industry and government.

Communication emerged as pivotal to both the pre-market and post-market stages across multiple discussions with participants regarding challenges, strategies, and roles. While some emphasized the limitations manufacturers face in direct communication with customers, especially for products sold through retailers or installed by integrators, others agreed that raising broader cybersecurity awareness is critical.

- Education and awareness strategies targeting both consumer and workforce users that focuses on explaining IoT product behavior, mitigating anomalies, and practicing strong cybersecurity hygiene.

Workshop Summary Report for “Workshop on Foundational Cybersecurity Activities for IoT Device Manufacturers”


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Digital Identity Guidelines_ Identity Proofing and Enrollment:

3.1.

3.3.1. Privacy Risk Assessment . . . . . . . . . . . . . . . . . . . . . .

4.3.1. Proofing Types . . . . . . . . . . . . . . . . . . . . . . . . . . .

Digital Identity Guidelines_ Identity Proofing and Enrollment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Security Considerations for Voice Over IP Systems:

| Figure 1. Voice Data Processing in a VOIP System. ................................................................... |   15 |
|-------------------------------------------------------------------------------------------------------------------------------------------|------|
| Figure 2. Sample Latency Budget ................................................................................................ |   20 |
| Figure 3. H.323 Architecture........................................................................................................ |   26 |
| Figure 4. H.323 Call Setup Process.............................................................................................. |   27 |
| Table 1: H235v2 Annex D - Baseline Security Profile ................................................................. |   29 |
| Table 2: H235v2 Annex E - Signature Security Profile ............................................................... |   30 |
| Table 3: H235v2 - Voice Encryption Option ................................................................................ |   31 |
| Table 4: H235v2 Annex F - Hybrid Security Profile.................................................................... |   32 |
| Table 5: H235v3 Annex D - Baseline Security Profile ................................................................. |   33 |
| Figure 5. SIP Network Architecture............................................................................................. |   40 |
| Figure 6. SIP Protocol .................................................................................................................. |   46 |
| Figure 7: General Scenario for MGCP Usage............................................................................... |   48 |
| Figure 8: General Scenario for MEGACO/H.248 Usage.............................................................. |   50 |
| Figure 9.

Security Considerations for Voice Over IP Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] How does Security Requirements for Cryptographic Modules support CMMC certification?

[Assistant]
According to Security Requirements for Cryptographic Modules:

as defined in 15 U.S.C. § 278g-3. This standard shall be used in designing and implementing cryptographic modules that federal departments and agencies operate or are operated for them under contract.
The standard provides four  increasing,  qualitative  levels  of  security  intended  to  cover  a  wide  range  of  potential applications and environments. The security requirements cover areas related to the secure design, implementation  and  operation  of  a  cryptographic  module. These  areas  include  cryptographic module  specification;  cryptographic  module  interfaces;  roles,  services,  and  authentication; software/firmware  security;  operating  environment;  physical  security;  non-invasive  security; sensitive security parameter management; self-tests; life-cycle assurance; and mitigation of other attacks. Key words : computer security; telecommunication security; physical security; software security; cryptography; cryptographic modules; Federal Information Processing Standard (FIPS); ISO/IEC 19790; ISO/IEC 24759. ## Federal Information Processing Standards Publication 140-3

March 22, 2019

## Announcing the Standard for

## SECURITY REQUIREMENTS FOR CRYPTOGRAPHIC MODULES

Federal Information Processing Standards Publications (FIPS PUBS) are issued by the National Institute  of  Standards  and  Technology  (NIST)  after  approval  by  the  Secretary  of  Commerce pursuant 15 USC 278g-3. 1. Name of Standard. Security Requirements for Cryptographic Modules (FIPS PUB 140-3). 2. Category of Standard. Computer Security Standard, Cryptography. 3. Explanation. This  standard  specifies  the  security  requirements  that  will  be  satisfied  by  a cryptographic  module  utilized  within  a  security  system  protecting  sensitive  but  unclassified information (hereafter referred to as sensitive information). The standard provides four increasing, qualitative levels of security: Level 1, Level 2, Level 3, and Level 4.

Security Requirements for Cryptographic Modules


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Measurement Guide for Information Security_ Volume 1 — Identifying and Selecting Measures:

After implementation measures are gathered, further analysis, not dissimilar to data normalization, is required before the results can be expressed to a non-technical audience. Successful effectiveness and efficiency assessments of individual phenomenon may require additional analysis using multiple measures. For example, when looking for 'delayed vulnerability remediations,' simply checking the mean time to incident response is unlikely to provide all of the information necessary to determine the causes of an issue.

Measurement Guide for Information Security_ Volume 1 — Identifying and Selecting Measures


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Guidelines on Electronic Mail Security:

|    |                                                                                |                                                                                | Summary..............................................................................................................ES-1   |
|----|--------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------|
| 1.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.2 (NIST 3.2.2)?

[Assistant]
According to Recommendation for Key Management_ Part 2 – Best Practices for Key Management Organizations:

3.2.2 Key Management Planning Information Requirements________________________                   | 34                                                                        |
| 4                                                                         | Key Management Specification______________________________________39      | Key Management Specification______________________________________39                             |                                                                           |
|                                                                           | 4. 3.2.2 Key Management Planning Information Requirements

The  level  of  key  management  planning  detail  required  for  cryptographic  applications  can  be tailored,  depending  upon  the  scope  and  complexity  of  the  application. 3.2.2.

Recommendation for Key Management_ Part 2 – Best Practices for Key Management Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Cybersecurity of Genomic Data:

| Potential Privacy Problems........................................................................................9                 |                                                                                |
| 3.3. | Discrimination and Reputational Concerns..............................................................10                            |                                                                                |
| 3.4. | Economic Concerns.................................................................................................11                |                                                                                |
| 3.5. | Health Outcome Concerns ......................................................................................11                    |                                                                                |
| 3.6. | Other Potential Future Concerns.............................................................................11                      |                                                                                |
| 3.7.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Understanding Stablecoin Technology and Related Security Considerations:

It may be possible for malicious users to engineer a scenario (e.g., via social engineering to obtain credentials or exploiting a weakness in the software development environment or deployment software) in which they obtain the ability to deploy updated versions of the stablecoin's smart contract. In such a scenario, as the attacker gains full control, they remove the ability for the original smart contract managers to further modify the smart contract - essentially hijacking the stablecoin system.

CeFi exchanges resemble a combination of a brokerage firm and a stock market exchange that deals only in cryptocurrencies. Users can create custodial accounts on CeFi exchanges just like they can with brokerage firms (often only after providing identity-proofing information). Each account may have two sub accounts that operate differently: one for fiat currency and one for cryptocurrency. Each fiat currency account acts like a typical cash account with a brokerage firm. The exchange is the custodian (i.e., they possess the currency) and uses an internal database to record the level of currency in each user account.

Each cryptocurrency account has a private/public keypair like a typical account created with a cryptocurrency wallet. However, in this case, the exchange holds the private key and only provides the users with their public key/account number. Using this information, a user can transfer cryptocurrency into their account but not out of it. To transfer funds out of it (e.g., to a wallet account that the user controls, to an account on another exchange, or to make a direct payment), the user authenticates to the exchange (e.g., using a multi-factor authentication approach) and requests that the exchange initiate the transfer with the user's private key.

Understanding Stablecoin Technology and Related Security Considerations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach:

................................................................. 40
3.2.4   Define and Analyze Specific Alternatives ..................................................................................
43
3.2.5   Develop Recommendations ...................................................................................................... 46

Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Security Recommendations for Server-based Hypervisor Platforms:

|
| HY-SR-17   | VM configuration management tools should have the capability to compile logs and alert administrators when configuration changes are detected in any VM that is being monitored.
| HY-BF4 (VM Lifecycle Management)           |
| HY-SR-18   | The access control solution for VM administration should have the granular capability both at the permission assignment level as well as at the object level (i.e., the specification of the target of the permission can be a single VM or any logical grouping of VMs - based on function or location). In addition, the ability to deny permission to some specific objects within a VM group (e.g., VMs running workloads of a particular sensitivity level) despite having access permission to the VM group | HY-BF4 (VM Lifecycle Management)           |
| HY-SR-19   | The administration of all hypervisor installations in the enterprise should be performed centrally using an enterprise virtualization management system (EVMS). Further enterprise gold-standard hypervisor configurations for different types of workloads and clusters must managed (enforced) through EVMS. The gold-standard configurations should at the minimum cover the following aspects - CPU, Memory, Storage, Network bandwidth and Host OS hardening (if required). | HY-BF5 (Management of hypervisor Platform) |
| HY-SR-20   | Protection for Hypervisor Host &Software administration functions should be ensured by allocating a dedicated physical NIC, or if that is not feasible, by placing the management interface of the hypervisor in a dedicated virtual network segment and enforcing traffic controls using a firewall (e.g., designating the subnets in the enterprise network from which incoming traffic into the management interface is allowed). | HY-BF5 (Management of hypervisor Platform) |

Security Recommendations for Server-based Hypervisor Platforms


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to ISCMA_ An Information Security Continuous Monitoring Program Assessment:

| 3.5 | Assessment Parameters............................................................................................23 | Assessment Parameters............................................................................................23 | | |-------|-----------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------| | 3.6 | Element Evaluation ...................................................................................................25 | Element Evaluation ...................................................................................................25 | | | | 3.6.1 | Judgment Selection ....................................................................................................28 | | | | 3.6.2 | Element-Level Judgment Assistance ..........................................................................28 | | | 3.7 | Scoring and Partial Results........................................................................................29 | Scoring and Partial Results........................................................................................29 | | | 3.8 | Action Buttons ..........................................................................................................31 | Action Buttons ..........................................................................................................31 | | | | 3.8.1 | Restart Assessment ....................................................................................................31 | | | | 3.8.2 | Merge Assessments....................................................................................................31 | | | | 3.8.3 | Export Data.................................................................................................................31 | | | | 3.8.4 | Tailor Assessment.......................................................................................................31 | | | 3.9 | Deploying the Workbook ..........................................................................................32 | Deploying the Workbook ..........................................................................................32 | | | 3.10 | Additional Underlying Worksheets ...........................................................................32 | Additional Underlying Worksheets ...........................................................................32 | | | 4 | The Principal Assessment Workbook....................................................................

ISCMA_ An Information Security Continuous Monitoring Program Assessment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Minimum Security Requirements for Federal Information and Information Systems:

## 5.  Maintenance Agency.

1 An information system is a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.  Information resources include information and related resources, such as personnel, equipment, funds, and information technology.

The minimum security requirements cover seventeen security-related areas with regard to protecting the confidentiality, integrity, and availability of federal information systems and the information processed, stored, and transmitted by those systems.  The security-related areas include: (i) access control; (ii) awareness and training; (iii) audit and accountability; (iv) certification, accreditation, and security assessments; (v) configuration management; (vi) contingency planning; (vii) identification and authentication; (viii) incident response; (ix) maintenance; (x) media protection; (xi) physical and environmental protection; (xii) planning; (xiii) personnel security; (xiv) risk assessment; (xv) systems and services acquisition; (xvi) system and communications protection; and (xvii) system and information integrity.  The seventeen areas represent a broad-based, balanced information security program that addresses the management, operational, and technical aspects of protecting federal information and information systems.

Minimum Security Requirements for Federal Information and Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Bug Framework (BF)_ Formalizing Cybersecurity Weaknesses and Vulnerabilities:

There may be references in this publica/t\_i.ligaon to other publica/t\_i.ligaons currently under development by NIST in accordance with its assigned statutory responsibili/t\_i.ligaes. The informa/t\_i.ligaon in this publica/t\_i.ligaon, including concepts and methodologies, may be used by federal agencies even before the comple/t\_i.ligaon of such companion publica/t\_i.ligaons. Thus, un/t\_i.ligal each publica/t\_i.ligaon is completed, current requirements, guidelines, and procedures, where they exist, remain opera/t\_i.ligave. For planning and transi/t\_i.ligaon purposes, federal agencies may wish to closely follow the development of these new publica/t\_i.ligaons by NIST. Organiza/t\_i.ligaons are encouraged to review all dra/f\_t.liga publica/t\_i.ligaons during public comment periods and provide feedback to NIST. Many NIST cybersecurity publica/t\_i.ligaons, other than the ones noted above, are available at h/t\_t.ligaps://csrc.nist.gov/publica/t\_i.ligaons.

Bug Framework (BF)_ Formalizing Cybersecurity Weaknesses and Vulnerabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Measuring the Usability and Security of Permuted Passwords on Mobile Platforms:

file called a password file , which often has corresponding operating system level logical access control mechanisms (e.g., file permissions) in place to prevent the reading and writing of this file.
The passwords of many users are often stored in the same password file alongside their associated username.

Measuring the Usability and Security of Permuted Passwords on Mobile Platforms


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Notional Supply Chain Risk Management Practices for Federal Information Systems:

| Reports on Computer Systems Technology_______________________ | Reports on Computer Systems Technology_______________________ | Reports on Computer Systems Technology_______________________ | |-----------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------| | NIST Interagency Reports ____________________________________iii | NIST Interagency Reports ____________________________________iii | NIST Interagency Reports ____________________________________iii | | Authority __________________________________________________iv | Authority __________________________________________________iv | Authority __________________________________________________iv | | Acknowledgements __________________________________________ v | Acknowledgements __________________________________________ v | Acknowledgements __________________________________________ v | | Abstract ___________________________________________________ v | Abstract ___________________________________________________ v | Abstract ___________________________________________________ v | | Keywords __________________________________________________ v | Keywords __________________________________________________ v | Keywords __________________________________________________ v | | 1 Introduction _____________________________________________ 1 | 1 Introduction _____________________________________________ 1 | 1 Introduction _____________________________________________ 1 | | 1.1 | Purpose ______________________________________________________________ | 2 | | 1.2 | Scope ________________________________________________________________ | 3 | | 1.3 | Background___________________________________________________________ | 4 | | 1.4 | Related Documents_____________________________________________________ | 4 | | 1.5 | Document Structure____________________________________________________ | 5 | | 2 | Overview ________________________________________________ | 6 | | 2.1 Challenges _____________________________________________________________ 6 | 2.1 Challenges _____________________________________________________________ 6 | 2.1 Challenges _____________________________________________________________ 6 | | 2.2 | Foundational Practices _________________________________________________ | 7 | | 3 Implementing Supply Chain Risk Management _______________ 11 | 3 Implementing Supply Chain Risk Management _______________ 11 | 3 Implementing Supply Chain Risk Management _______________ 11

Notional Supply Chain Risk Management Practices for Federal Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Guide to SSL VPNs:

Some of the cryptographic requirements, including allowable hash functions and certificate key lengths, will change at the end of 2010. Therefore, Federal agencies who want to provide SSL VPN services after 2010 must ensure that their systems are upgradeable to the new FIPS-compliant cipher suites and key lengths before the end of 2010, and that their SSL VPN vendors guarantee that such upgrades will be available early enough for testing and deployment in the field. 1. Identify Requirements. The first phase of the process involves identifying the current and future requirements for remote access and determining how they can best be met by an SSL VPN implementation. Determining requirements for U.S. federal agencies also means assessing how to comply with FIPS 140-2. 2. Design the Solution. The second phase involves all aspects of designing an SSL VPN solution. The design elements are grouped into five categories: access control, endpoint security, authentication methods, architecture, and cryptography policy. 3. Implement and Test a Prototype. The next phase involves implementing and testing a prototype in a laboratory or test environment. The primary goals are to evaluate all aspects of the solution including authentication, application compatibility, management, logging, performance, security of the implementation, design and layout of the VPN portal, and default settings. 4. Deploy the Solution. Once testing is completed and all issues are resolved, the next phase includes the deployment of the SSL VPN throughout the enterprise. This phase addresses issues specific to SSL VPNs that may occur during deployment. Support must be addressed, and this includes the process of working with a help desk to provide assistance for end users. 5. Manage the Solution. After the SSL VPN solution has been deployed, it must be managed throughout its lifecycle.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to ISCMA_ An Information Security Continuous Monitoring Program Assessment:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes  the  U.S.  economy  and  public  welfare  by  providing  technical  leadership  for  the  Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems.

- NIST SP 800-137 [SP800-137] describes the desirable properties of an ISCM program and the process for establishing an ISCM program in an organization.
- NIST SP 800-137A [SP800-137A] provides guidance on the development of an ISCM program assessment and describes the desirable properties of an ISCM program assessment methodology and the process for assessing the effectiveness of an ISCM program in an organization. The assessment methodology described in SP 800-137A has been followed in this report and implemented in the [ISCMAx] companion tool.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to PIV Card Application and Middleware Interface Test Guidelines (SP 800-73-4 Compliance):

| 1. INTRODUCTION.....................................................................................................................1                                                                                | 1. INTRODUCTION.....................................................................................................................1                                                                                | 1. INTRODUCTION.....................................................................................................................1                                                                                | 1.

PIV Card Application and Middleware Interface Test Guidelines (SP 800-73-4 Compliance)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.6 (NIST 3.2.6)?

[Assistant]
According to Notional Supply Chain Risk Management Practices for Federal Information Systems:

3.2.6 Operational Contract Execution

Once a system becomes operational, the operating environment may change.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.5 (NIST 3.3.5)?

[Assistant]
According to Guide to Operational Technology (OT) Security:

3.3.5. 3.3.5.

Guide to Operational Technology (OT) Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices:

Type.............................................................98 | | | C.3.5.8 System and Network Monitoring Information Type...............................................100 | | | C.3.5.9 Information Sharing Information Type...................................................................101 | | | APPENDIX D: IMPACT DETERMINATION FOR MISSION-BASED INFORMATION AND INFORMATION SYSTEMS......................................................102 | | | D.2 Homeland Security..............................................................................................................

Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Guidelines for Derived Personal Identity Verification (PIV) Credentials:

-  Communication between the issuer and the cryptographic module in which the Derived PIV Authentication private key is stored shall occur only over mutually authenticated secure sessions between tested and validated cryptographic modules. 5
-  Data transmitted between the issuer and the cryptographic module in which the Derived PIV Authentication private key is stored shall be encrypted and contain data integrity checks.

-  If the Derived PIV Credential is issued by the same agency or issuer that issued the Subscriber's PIV Card, then the Derived PIV Credential issuer may have direct access to the Identity Management System (IDMS) database implemented by the issuing agency that contains the relevant information about the Subscriber.
-  When the issuer of the Derived PIV Credential is different from the PIV Card Issuer, the following mechanisms may be applied:
- o The Backend Attribute Exchange [BAE] can be queried for the termination status of the PIV Card, if an attribute providing this information is defined and the issuer of the PIV Card maintains this attribute for the Subscriber. The BAE can also be queried for other attributes about the Subscriber (e.g., name) that may appear in the Derived PIV Authentication certificate.
- o The issuer of the Derived PIV Credential notifies the original PIV issuer when a Derived PIV Credential is created. The issuer of the PIV Card maintains a list of corresponding Derived PIV Credential issuers and sends notification to the latter set when the PIV Card is terminated or when attributes about the cardholder change. Such notification should provide evidence of receipt and the integrity of the message.
- o If a Uniform Reliability and Revocation Service (URRS) is implemented in accordance with Section 3.7 of [NISTIR7817], the issuer of a Derived PIV Credential may obtain termination status of the Subscriber's PIV Card through the URRS.

Guidelines for Derived Personal Identity Verification (PIV) Credentials


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Recommendation for Stateful Hash-Based Signature Schemes:

|
| [12]  | Buchmann J, Dahmen E, Hulsing A (2011) XMSS - A Practical Forward Secure Signature Scheme based on Minimal Security Assumptions .
Cryptology ePrint Archive , Report 2011/484. https://eprint.iacr.org/2011/484.pdf                                                                  |
| [13]  | Bruinderink LG, Hülsing A (2016) 'Oops, I did it again' - Security of One- Time Signatures under Two-Message Attacks. Cryptology ePrint Archive , Report 2016/1042. https://eprint.iacr.org/2016/1042.pdf                                                                            |
| [14]  | Perlner R, Cooper D (2009) Quantum Resistant Public Key Cryptography: A Survey. 8th Symposium on Identity and Trust on the Internet (IDtrust 2009) , pp 85-93. https://doi.org/10.1145/1527017.1527028                                                                               |
| [15]  | Eaton E (2017) Leighton-Micali Hash-Based Signatures in the Quantum Random-Oracle Model. Cryptology ePrint Archive , Report 2017/607. https://eprint.iacr.org/2017/607                                                                                |
| [16]  | Bernstein DJ, Hülsing A, Kölbl S, Niederhagen R, Rijneveld J, Schwabe P (2019) The SPHINCS+ Signature Framework. Cryptology ePrint Archive , Report 2019/1086. https://eprint.iacr.org/2019/1086.pdf                                                                                |
| [17]  | Malkin T, Micciancio D, Miner S (2002) Efficient generic forward-secure signatures with an unbounded number of time periods. Advances in Cryptology -EUROCRYPT 2002 , Lecture Notes in Computer Science 2332, pp 400-417. https://doi.org/10.1007/3-540-46035-7_27                   |
| [18]  | Merkle RC (1979) Security, Authentication, and Public Key Systems . PhD thesis, Stanford University, June 1979.

Recommendation for Stateful Hash-Based Signature Schemes


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Guidelines for API Protection for Cloud-Native Systems:

...............14                     |
| 2.7.5. Reaching Out to Other Systems .................................................................................................15            |
| 2.7.7.
Identity Canonicalization............................................................................................................16      |
| 3. Recommended Controls for APIs...................................................................................................17               |
| 3.1.1. Basic Pre-Runtime Protections...................................................................................................18           |
| 3.1.2. Advanced Pre-Runtime Protections ...........................................................................................19               |
| 3.2.1. Basic Runtime Protections..........................................................................................................20        |

Guidelines for API Protection for Cloud-Native Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations:

| Scope..............................................................................................................
| 2                                                                                |
|                                                                                | 1.2.1 Alternative Configurations                                                                                | ....................................................................3                                                        |
| 1.3                                                                                | Document Conventions................................................................................... | 3                                                                                |
| 2 TLS Overview .........................................................................................................4    | 2 TLS Overview .........................................................................................................4    | 2 TLS Overview .........................................................................................................4    |
| 2.1                                                                                | TLS Subprotocols                                                                                | ...........................................................................................

Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.1 (NIST 3.2.1)?

[Assistant]
According to The Common Configuration Scoring System (CCSS)_ Metrics for Software Security Configuration Vulnerabilities:

3.2.1                                                                                | Base Equation ... 3.2.1 Base Equation

The base equation is the foundation of CCSS scoring.

The Common Configuration Scoring System (CCSS)_ Metrics for Software Security Configuration Vulnerabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Integrating Cybersecurity and Enterprise Risk Management (ERM):

Air Force; U.S. Department of Defense; U.S. At higher levels in the enterprise structure, those cybersecurity and other risk registers are aggregated, normalized, and prioritized into risk profiles .
A risk profile is defined by OMB Circular A-123 as 'a prioritized inventory of the most significant risks identified and assessed through the risk assessment process versus a complete inventory of risks' [3]. While it is critical that enterprises address potential negative impacts on mission and business objectives, it is equally critical (and required for federal agencies) that enterprises plan for success. OMB states in Circular A-123 that 'the [Enterprise Risk] profile must identify sources of uncertainty, both positive (opportunities) and negative (threats).' Enterprise-level decision makers use the risk profile to choose which enterprise risks to address, allocate resources, and delegate responsibilities to appropriate risk owners. ERM programs should define terminology, formats, criteria, and other guidance for risk inputs from lower levels of the enterprise.

Integrating Cybersecurity and Enterprise Risk Management (ERM)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to PIV Card Application and Middleware Interface Test Guidelines (SP 800-73-4 Compliance):

| A.4.2.2   | VERIFY                                                    | Provides the key reference for PIV Card Application PIN, Global PIN, pairng code, or OCC as well as its corresponding value.
Sets/updates the PIV Card Application security status on the card; optionally (according to discovery object) establishes VCI with pairing code after pivEstablishSecureMessaging is invoked. |
| pivLogOutOfCardApplication               | A.4.2.4   | VERIFY                                                    | Resets the security status on all local key references. |
| pivGetData                               | A.4.2.3   | GET DATA                                                  | Maps the OID to BER-TLV tag for the selected object. |
| pivPutData                               | A.4.4.1   | PUT DATA                                                  | Maps the OID to BER-TLV tag for the selected object. |
| pivGenerateKeyPair                       | A.4.4.2   | GENERATE ASYMMETRIC KEY PAIR                              | Passes the key reference and cryptographic mechanism identifier value. |
| pivCrypt                                 | A.4.3.1   | GENERAL AUTHENTICATE                                      | Passes the key reference, cryptographic algorithm reference and the string to be acted upon. Sets/updates the PIV Card Application security status on the card, if applicable. |
| pivMiddlewareVersion                     | A4.1.3    | No equivalent command                                     | Returns the PIV Middleware version supported by the PIV Middleware IUT. |
| pivEstablishSecureMessaging              | A.4.2.5   | GENERAL AUTHENTICATE 5                                    | Passes the key reference and cryptographic algorithm reference to the PIV Card Application in order to establish secure messaging. Establishes, controls, and maintains the session key. |


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Approaches and Challenges of Federal Cybersecurity Awareness Programs:

## Approaches and Challenges of Federal Cybersecurity Awareness Programs

## Approaches and Challenges of Federal Cybersecurity Awareness Programs

Organizational security awareness programs experience a number of challenges, including lack of resources, difficulty measuring the impact of the program, and perceptions among the workforce that training is a boring, 'check-the-box' activity. While prior surveys and research have examined programs in the private sector, there is little understanding of whether these findings also apply within the U.S. government. To address this gap and better understand the needs, challenges, practices, and necessary competencies of federal security awareness teams and programs, NIST conducted a research study that leveraged both qualitative and quantitative methodologies. This companion document to NISTIR 8420 'Federal Cybersecurity Awareness Programs: A Mixed Methods Research Study' reports on a subset of study results focused on identifying the current approaches and challenges of security awareness programs within the federal government. Insights gained from these results are informing guidance and other initiatives to aid federal organizations in building effective security awareness programs. While focused on the U.S. government, findings may also have implications for organizational security awareness programs in other sectors.

Approaches and Challenges of Federal Cybersecurity Awareness Programs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Technical Guide to Information Security Testing and Assessment:

is most effective when system files are compared with a reference database created using a system known to be secure-this helps ensure that the reference database was not built with compromised files.
The reference database should be stored offline to prevent attackers from compromising the system and covering their tracks by modifying the database. In addition, because patches and other updates change files, the checksum database should be kept up-todate.

Technical Guide to Information Security Testing and Assessment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Foundations of a Security Policy for Use of the National Research and Educational Network:

Most of the current research deals with the technical issues of enforcing specific aspects of security e.g. access controls and encryption. Comparatively little attention has been given to the development of a meaningful and generally accepted 'policy' for information security that would be applicable to a diverse set of users and computers in interconnected networks. 1. The NREN will evolve from the existing Internet base and will have to fit into an international environment sponsored or owned by non-U.S. organizations. 2. Special purpose networks and mission-oriented networks (sponsored by the U.S. government) will need to link with, if not directly support, the NREN. 3. The architecture must accommodate the use of commercial services, private and governmentsponsored networks. 4. The architecture will continue to be layered set of protocols although it may differ from present Internet and planned OSI structures in some respects. 5. The system will support multiple protocols, including at lecist full TCP/IP and OSI protocol stacks, on an end-to-end basis. 6. The architecture must accommodate local areas networks (LANS), metropolitan area networks (MANS), regional networks, and wide-area networks (WANS) - some of which will support transit (pass through) traffic originating and terminating in other networks. 7. A variety of current and evolving technologies may be used including such things as high-speed Fiber Data Distributed Interface (FDDI), Distributed-Queue Dual Bus (DQDB), broadband Integrated Services Digital Network (ISDN) utilizing Asynchronous Transfer Mode (ATM) switching as well as conventional Token Ring, Ethernet, and other technologies. 8. Services accessible through the NREN will include various kinds of servers for general support (network management facilities, name servers, electronic mail, database servers, multicast routers, cryptographic certificate servers), collaboration support tools (video/teleconferencing), and other groupware facilities.

Foundations of a Security Policy for Use of the National Research and Educational Network


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does BowTie – A deep learning feedforward neural network for sentiment analysis provide? (Part 4)

[Assistant]
rchers argue that the gradient descent method has an implicit bias that is not yet fully understood, especially in cases where there are multiple solutions that properly classify a given dataset [14].
Thus, it is important to have a neural network with low loss estimates for a trained model to hope for a good and reliable transfer accuracy. The primary goal of this paper is to shed light on how to address these issues in practice. To do this, I introduce a new feedforward neural network for sentiment analysis and draw on the experiences from using it with two different types of word encoding: a simple one based on the word ranking in the dataset vocabulary; the other judiciously enhanced with meta-data related to word polarity. The main contribution of this paper is the design of the BowTie neural network in Section 2. ## 1 Data encoding and datasets

As discussed above, there are many different types of encodings of text with different complexity and degree of effectiveness. Since there is no convincing positive correlation established in the literature between complexity of the encoding and higher prediction accuracy, it is important to investigate the extent to which simple data encodings can be used for sentiment analysis. Simpler encodings have been shown to be robust and efficient [3]. But can they provide high prediction accuracy in sentiment analysis? I investigate this open question by evaluating the accuracy one may attain using two types of text encoding on representative benchmark datasets. ## 1.1 Multi-hot encoding

The first encoding is the multi-hot encoding of text [6] which can be defined as follows. Figure 1. A multi-hot encoded text in D, Π D with M = 88 587 . Figure 2. A polarityweighted multi-hot encoded text in D, Π D with M = 89527 . <!-- image -->

Let π be a linguistic type (e.g. morpheme, word) and let Π D be the set of all such linguistic types in a dataset D . Let M = | Π D | be the cardinality of Π D .

BowTie – A deep learning feedforward neural network for sentiment analysis


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Prioritizing Cybersecurity Risk for Enterprise Risk Management:

......................22       |
| 2.3.3. Risk Transfer................................................................................................................................22     |
| 2.3.4.
Risk Mitigation.............................................................................................................................23      |
| 2.3.5. Relationship of Risk Response to Risk Strategy ..........................................................................26                         |
| 2.3.6. Implicit Acceptance.....................................................................................................................28          |
| 2.3.7. Responding to Positive Risk Scenarios ........................................................................................30                    |
| 2.4.1. Risk Response Cost......................................................................................................................31          |
| 2.4.2. Risk Response Description ..........................................................................................................32              |
| 2.4.4. Status...........................................................................................................................................34 |
| Conclusion ...................................................................................................................................36           |
| 3. |
| Appendix B. Change Log...................................................................................................................41                |

Prioritizing Cybersecurity Risk for Enterprise Risk Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study:

Unfortunately, security awareness efforts may face significant challenges. Industry surveys and research studies have discovered that security awareness programs in organizations of all sizes may be underfunded and often rely on part-time security awareness professionals who may lack sufficient background, skills, tools, or resources necessary for managing an effective program [SANS][WOELK][BADA][STEWART]. Furthermore, employees may view training as boring and burdensome [BADA]. While mandates enforce a minimum baseline for security awareness, when viewed simply as a 'check-the-box' exercise, organizations may begin to measure program success simply in terms of compliance metrics, like training completion rates. However, these metrics reveal little about the effectiveness of the training in changing and sustaining workforce attitudes and behaviors [FERTIG].

Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case:

The IT personnel also installed and configured a Historian database on the manufacturing floor to record manufacturing process data. IT personnel are responsible for regular data backup of the Historian, and the manufacturing engineers are responsible for the configuration and operation of the Historian. 1. IT assets must only be used for the business activities they are assigned and authorized to perform. 2. Every employee is responsible for the preservation and proper use of the IT assets they have been assigned. 3. IT assets must not be left unduly exposed. 4. Desktops and laptops must be locked if left unattended. This policy should be automatically enforced whenever possible. 5. IT assets must not be accessed by non-authorized individuals. Authorization can be obtained from Director of Operations. 6. Configuration changes are to be conducted through the change control process, identifying risks and noteworthy implementation changes. 7. All assets must be protected by authentication technologies (e.g., passwords). 8. Passwords must follow the password policy. 9. The Director of Operations must be notified immediately after an asset is discovered to be lost or stolen. 10. Use of personal devices to access IT resources is prohibited. 11. Storage of sensitive information on portable media is prohibited, unless authorized by the Director of Operations. 12. Any sensitive information stored on IT assets, or being transported on a portable device, must be protected in such a way to deny unauthorized access, and must be encrypted in line with industry best practices and any applicable laws or regulations. 1. OT assets must not be used for operations they are not assigned or authorized to perform. 2. The Director of Operations and Operators are responsible for the preservation and correct use of the OT assets they have been assigned. 3. Physical access to OT assets is forbidden for non-authorized personnel. 4.

Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 2 – Process-based Manufacturing System Use Case


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Automation Support for Security Control Assessments_ Software Vulnerability Management:

a)                            | FLAW REMEDIATION | TIME TO REMEDIATE FLAWS / BENCHMARKS FOR CORRECTIVE ACTIONS The organization: (a) Measures the time between flaw identification and flaw remediation.
|
| SI-2(3)(b)                            | FLAW REMEDIATION | TIME TO REMEDIATE FLAWS / BENCHMARKS FOR CORRECTIVE ACTIONS The organization: (b) Establishes [Assignment: organization-defined benchmarks] for taking corrective actions. |
| SI-2(5)                               | FLAW REMEDIATION | AUTOMATIC SOFTWARE / FIRMWARE UPDATES The organization installs [Assignment: organization-defined security-relevant software and firmware updates] automatically to [Assignment: organization- defined information system components]. |
| SI-2(6)                               | FLAW REMEDIATION | REMOVAL OF PREVIOUS VERSIONS OF SOFTWARE / FIRMWARE The organization removes [Assignment: organization-defined software and firmware components] after updated versions have been installed. |
| SI-3(10)(b)                           | MALICIOUS CODE PROTECTION | MALICIOUS CODE ANALYSIS The organization: (b) Incorporates the results from malicious code analysis into organizational incident response and flaw remediation processes. |
| SI-14                                 | NON-PERSISTENCE Control: The organization implements non-persistent [Assignment: organization-defined information system components and services] that are initiated in a known state and terminated [Selection (one or more): upon end of session of use; periodically at [Assignment: organization-defined frequency]]. |
| SI-14(1)                              | NON-PERSISTENCE | REFRESH FROM TRUSTED SOURCES The organization ensures that software and data employed during information system component and service refreshes are obtained from [Assignment: organization-defined trusted sources]. |

Automation Support for Security Control Assessments_ Software Vulnerability Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Guide to Intrusion Detection and Prevention Systems (IDPS):

| Introduction ......................................................................................................................1-1 | Introduction ......................................................................................................................1-1 | | | 1.1 | | Authority...................................................................................................................1-1 | | | | 1.2 | Purpose and Scope .................................................................................................1-1 | | | | 1.3 | Audience..................................................................................................................1-1 | | | | 1.4 | Document Structure.................................................................................................1-1 | | | | Intrusion Detection and Prevention Principles .............................................................2-1 | Intrusion Detection and Prevention Principles .............................................................2-1 | | | 2.

Guide to Intrusion Detection and Prevention Systems (IDPS)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Zero Trust Architecture:

El NCPS (por su nombre en inglés National Cybersecurity Protection System y conocido operativamente como Einstein) es un sistema integrado que incluye subsistemas. Este ofrece servicios de detección de intrusiones, análisis avanzados, intercambio de información y prevención de intrusiones para defender al Gobierno Federal de las ciberamenazas. Los objetivos del NCPS, que se alinean con los objetivos generales de la confianza cero, consisten en gestionar el riesgo cibernético, mejorar la ciberprotección y capacitar a los socios para asegurar el ciberespacio. Los sensores de Einstein permiten al Centro Nacional de Integración de la Ciberseguridad y las Comunicaciones (NCCIC, por su nombre en inglés National Cybersecurity and Communications Integration Center) de la Agencia de Seguridad de Infraestructura y Ciberseguridad CISA (por su nombre en inglés Cybersecurity and Infrastructure Security Agency) responder a incidentes significativos en las agencias federales y defender sus redes.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.1 (NIST 3.2.1)?

[Assistant]
According to Guidelines for the Secure Deployment of IPv6:

3.2.1 IPv6 Address Assignments ... 3.2.1 IPv6 Address Assignments ... 3.2.1 describes address assignments using leftmost, rightmost, and centermost strategies.

Guidelines for the Secure Deployment of IPv6


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.7 (NIST 3.2.7)?

[Assistant]
According to Guide to Bluetooth Security:

3.2.7 Bluetooth Link Key Derivation from Low Energy Long TermKey... 3.2.7 Bluetooth Link Key Derivation from Low Energy Long TermKey... 3.2.7 for details.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP) provide? (Part 2)

[Assistant]
ral agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative.
For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## Authority

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST.

Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Guidelines on PDA Forensics:

-  Testability - Has the scientific theory or technique been empirically tested? According to K. Popper (1989) in The Growth of Scientific Knowledge, "the criterion on the scientific status of a theory is its falsifiability, refutability, and testability."
-  Acceptance - Has the scientific theory or technique been subjected to peer review and publication? This ensures that flaws in the methodology would have been detected and that the technique is finding its way into use via the literature. -  Error Rate - What is the known or potential error rate? Scientific measures generally have associated error rates, which can be estimated with a fair amount of precision. Known threats exist against the validity and reliability in any test (experimental and quasi-experimental) of a theory. -  Credibility - What is the expert's qualifications and stature in the scientific community? Does the technique rely upon the special skills and equipment of one expert, or can it be replicated by other experts elsewhere? -  Clarity - Can the technique and its results be explained with sufficient clarity and simplicity so that the court and the jury can understand its plain meaning? This criterion is assumed to be incorporated in Daubert implicitly. -  Gain access through a hardware backdoor - Hardware backdoors, such as interfaces for debugging, production testing, or maintenance, may be used to gain access to memory. For example, some devices have active hardware test points on the circuit board that can be used to probe the device. Many manufacturers now support the JTAG (Joint Test Action Group) standard, which defines a common test interface for processor, memory, and other semiconductor chips, on their devices [Int96]. Forensic examiners can communicate with a JTAG-compliant component by utilizing software and an add-in hardware controller in a personal computer card slot or a special purpose stand-alone programmer device to probe defined test points.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Computer Security Division 2004 Annual Report provide? (Part 2)

[Assistant]
4 was a challenge from the President, issued in Homeland Security Presidential Directive #12, to develop a new standard for  identification  and  verification of  Federal  employees  and  contractors.
We continued  making  progress  in  fulfilling  the mandates  of  the  Federal  Information  Security Management  Act  of  2002  which  resulted  in Federal  Information  Processing  Standard  (FIPS) 199, Standards for Security Categorization of Federal Information and Information Systems , and NIST Special Publication (SP)  800-53, Recommended  Security  Controls  for  Federal Information Systems . In addressing the President's challenge, we drew heavily upon our ongoing smart card, biometric and cryptographic work. As such, we made great strides towards a framework  for protecting Federal facilities, systems and the employees who have access to them. The long-term benefit of using FIPS 199, SP  800-53  and  a  standards-based  approach  to system security in general is more targeted, costeffective, consistent  and  improved  security. While the interconnection of information systems often increases the risk to an organization's operations  and  assets, FIPS  199  and  our  associated suite  of  standards  and  guidelines  provide  a common  way  to  express  information  security requirements. This  in  turn  promotes  greater consistency across diverse organizations in managing risks. Scientists  in  the  Computer  Security  Division have  been  working  with  our  partners  for  the past  several  years  to  establish  a  Government Smart  Card  (GSC)  program  to  facilitate  widespread deployment of interoperable smart card systems. In  recognition of this work, the NIST Smart  Card  Team  received  the  Department  of Commerce's  2004  Gold  Medal  Award  for  the development of a framework and specification that  dramatically  advanced  interoperability among smart card applications, coalesced  U.S.

Computer Security Division 2004 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.5 (NIST 3.1.5)?

[Assistant]
According to Measurement Guide for Information Security_ Volume 1 — Identifying and Selecting Measures:

3.1.5. 3.1.5.

Measurement Guide for Information Security_ Volume 1 — Identifying and Selecting Measures


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IR.L2-3.6.2 (NIST 3.6.2)?

[Assistant]
According to A Comparison of Attribute Based Access Control (ABAC) Standards for Data Service Applications_ Extensible Access Control Markup Language (XACML) and N:

3.6.2 Access Request Processing in Delegation Chains... 3.6.2 Access Request Processing in Delegation Chains

In the absence of any delegation chain, all access policies in the system are (trusted) Access Policies.

A Comparison of Attribute Based Access Control (ABAC) Standards for Data Service Applications_ Extensible Access Control Markup Language (XACML) and N


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Measurement Guide for Information Security_ Volume 1 — Identifying and Selecting Measures:

There may be references in this publication to other publications currently under development by NIST in methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

By keeping metrics consistent over time, organizations can evaluate long-term trends and related to metrics over a continuous period (e.g., quarter to quarter, year to year) will give more information about the success of organization-, program-, and system-level information security plans, policies, procedures, and goals. Some metrics may be gathered because of external guidance or regulations.

Implementation measures demonstrate the progress of specific controls. Monitoring implementation may include assessment results, such as a tally of known systems or a binary 'yes/no' about which systems have up-to-date patches. 9 Implementation measures look at quantitative outputs and are usually demonstrated in percentages. Examples of implementation measures related to information security programs include the percentage of systems with approved system security plans and the percentage of systems with password policies that are configured as required. Implementation measures can also examine systemlevel areas, such as the percentage of servers in a system with a standard configuration.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.1 (NIST 3.1.1)?

[Assistant]
According to Guide for Mapping Types of Information and Information Systems to Security Categories:

3.1.1                                                                                | Security Categories... 3.1.1 Security Categories

FIPS 199 establishes security categories for both information 6 and information systems.

Guide for Mapping Types of Information and Information Systems to Security Categories


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to The NIST Cybersecurity Framework (CSF) 2.0:

- improvement opportunities for the organization's policies, plans, processes, procedures, and practices that support cybersecurity risk management to inform efforts under all six Functions. - PROTECT (PR) -Safeguards to manage the organization's cybersecurity risks are used. Once assets and risks are identified and prioritized, PROTECT supports the ability to secure those assets to prevent or lower the likelihood and impact of adverse cybersecurity events, as well as to increase the likelihood and impact of taking advantage of opportunities. Outcomes covered by this Function include identity management, authentication, and access control; awareness and training; data security; platform security (i.e., securing the hardware, software, and services of physical and virtual platforms); and the resilience of technology infrastructure. - DETECT (DE) -Possible cybersecurity attacks and compromises are found and analyzed. DETECT enables the timely discovery and analysis of anomalies, indicators of compromise, and other potentially adverse events that may indicate that cybersecurity attacks and incidents are occurring. This Function supports successful incident response and recovery activities. - RESPOND (RS) -Actions regarding a detected cybersecurity incident are taken. RESPOND supports the ability to contain the effects of cybersecurity incidents. Outcomes within this Function cover incident management, analysis, mitigation, reporting, and communication. - RECOVER (RC) -Assets and operations affected by a cybersecurity incident are restored. RECOVER supports the timely restoration of normal operations to reduce the effects of cybersecurity incidents and enable appropriate communication during recovery efforts. ## 3.1.

The NIST Cybersecurity Framework (CSF) 2.0